Consumer Online Privacy Rights Act

II 116TH CONGRESS 1ST SESSION S. 2968 To provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement. IN THE SENATE OF THE UNITED STATES DECEMBER 3, 2019 Ms. CANTWELL (for herself, Mr. SCHATZ, Ms. KLOBUCHAR, and Mr. MAR- KEY) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish mean- ingful enforcement. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) SHORT TITLE.—This Act may be cited as the 4 ‘‘Consumer Online Privacy Rights Act’’. 5 (b) TABLE OF CONTENTS.—The table of contents of 6 this Act is as follows: 7 Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. Effective date. VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 2 •S 2968 IS TITLE I—DATA PRIVACY RIGHTS Sec. 101. Duty of loyalty. Sec. 102. Right to access and transparency. Sec. 103. Right to delete. Sec. 104. Right to correct inaccuracies. Sec. 105. Right to controls. Sec. 106. Right to data minimization. Sec. 107. Right to data security. Sec. 108. Civil rights. Sec. 109. Prohibition on waiver of rights. Sec. 110. Limitations and applicability. TITLE II—OVERSIGHT AND RESPONSIBILITY Sec. 201. Executive responsibility. Sec. 202. Privacy and data security officers; comprehensive privacy and data security programs; risk assessments and compliance. Sec. 203. Service providers and third parties. Sec. 204. Whistleblower protections. Sec. 205. Digital content forgeries. TITLE III—MISCELLANEOUS Sec. 301. Enforcement, civil penalties, and applicability. Sec. 302. Relationship to Federal and State laws. Sec. 303. Severability. Sec. 304. Authorization of appropriations. SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) AFFIRMATIVE EXPRESS CONSENT.— 3 (A) IN GENERAL.—The term ‘‘affirmative 4 express consent’’ means an affirmative act by 5 an individual that clearly communicates the in- 6 dividual’s authorization for an act or practice, 7 in response to a specific request that meets the 8 requirements of subparagraph (B). 9 (B) REQUEST REQUIREMENTS.—The re- 10 quirements of this subparagraph with respect to 11 a request from a covered entity to an individual 12 are the following: 13 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 3 •S 2968 IS (i) The request is provided to the indi- 1 vidual in a standalone disclosure. 2 (ii) The request includes a description 3 of each act or practice for which the indi- 4 vidual’s consent is sought and— 5 (I) clearly distinguishes between 6 an act or practice which is necessary 7 to fulfill a request of the individual 8 and an act or practice which is for an- 9 other purpose; and 10 (II) is written in easy-to-under- 11 stand language and includes a promi- 12 nent heading that would enable a rea- 13 sonable individual to identify and un- 14 derstand the act or practice. 15 (iii) The request clearly explains the 16 individual’s applicable rights related to 17 consent. 18 (C) EXPRESS CONSENT REQUIRED.—An 19 entity shall not infer that an individual has pro- 20 vided affirmative express consent to an act or 21 practice from the inaction of the individual or 22 the individual’s continued use of a service or 23 product provided by the entity. 24 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 4 •S 2968 IS (2) ALGORITHMIC DECISION-MAKING.—The 1 term ‘‘algorithmic decision-making’’ means a com- 2 putational process, including one derived from ma- 3 chine learning, statistics, or other data processing or 4 artificial intelligence techniques that makes a deci- 5 sion or facilitates human decision-making with re- 6 spect to covered data. 7 (3) BIOMETRIC INFORMATION.— 8 (A) IN GENERAL.—The term ‘‘biometric 9 information’’ means any covered data generated 10 from the measurement or specific technological 11 processing of an individual’s biological, physical, 12 or physiological characteristics, including— 13 (i) fingerprints; 14 (ii) voice prints; 15 (iii) iris or retina scans; 16 (iv) facial scans or templates; 17 (v) deoxyribonucleic acid (DNA) infor- 18 mation; and 19 (vi) gait. 20 (B) EXCLUSIONS.—Such term does not in- 21 clude writing samples, written signatures, pho- 22 tographs, voice recordings, demographic data, 23 or physical characteristics such as height, 24 weight, hair color, or eye color, provided that 25 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 5 •S 2968 IS such data is not used for the purpose of identi- 1 fying an individual’s unique biological, physical, 2 or physiological characteristics. 3 (4) COLLECT; COLLECTION.—The terms ‘‘col- 4 lect’’ and ‘‘collection’’ mean buying, renting, gath- 5 ering, obtaining, receiving, accessing, or otherwise 6 acquiring covered data by any means, including by 7 passively or actively observing the individual’s behav- 8 ior. 9 (5) COMMON BRANDING.—The term ‘‘common 10 branding’’ means a shared name, servicemark, or 11 trademark. 12 (6) CONTROL.—The term ‘‘control’’ means, 13 with respect to an entity— 14 (A) ownership of, or the power to vote, 15 more than 50 percent of the outstanding shares 16 of any class of voting security of the entity; 17 (B) control in any manner over the election 18 of a majority of the directors of the entity (or 19 of individuals exercising similar functions); or 20 (C) the power to exercise a controlling in- 21 fluence over the management of the entity. 22 (7) COMMISSION.—The term ‘‘Commission’’ 23 means the Federal Trade Commission. 24 (8) COVERED DATA.— 25 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 6 •S 2968 IS (A) IN GENERAL.—The term ‘‘covered 1 data’’ means information that identifies, or is 2 linked or reasonably linkable to an individual or 3 a consumer device, including derived data. 4 (B) EXCLUSIONS.—Such term does not in- 5 clude— 6 (i) de-identified data; 7 (ii) employee data; and 8 (iii) public records. 9 (9) COVERED ENTITY.— 10 (A) IN GENERAL.—The term ‘‘covered en- 11 tity’’ means any entity or person that— 12 (i) is subject to the Federal Trade 13 Commission Act (15 U.S.C. 41 et seq.); 14 and 15 (ii) processes or transfers covered 16 data. 17 (B) INCLUSION OF COMMONLY CON- 18 TROLLED AND COMMONLY BRANDED ENTI- 19 TIES.—Such term includes any entity or person 20 that controls, is controlled by, is under common 21 control with, or shares common branding with 22 a covered entity. 23 (C) EXCLUSION OF SMALL BUSINESS.— 24 Such term does not include a small business. 25 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 7 •S 2968 IS (10) DE-IDENTIFIED DATA.—Term ‘‘de-identi- 1 fied data’’ means information that cannot reasonably 2 be used to infer information about, or otherwise be 3 linked to, an individual, a household, or a device 4 used by an individual or household, provided that 5 the entity— 6 (A) takes reasonable measures to ensure 7 that the information cannot be reidentified, or 8 associated with, an individual, a household, or 9 a device used by an individual or household; 10 (B) publicly commits in a conspicuous 11 manner— 12 (i) to process and transfer the infor- 13 mation in a de-identified form; and 14 (ii) not to attempt to reidentify or as- 15 sociate the information with any individual, 16 household, or device used by an individual 17 or household; and 18 (C) contractually obligates any person or 19 entity that receives the information from the 20 covered entity to comply with all of the provi- 21 sions of this paragraph. 22 (11) DERIVED DATA.—The term ‘‘derived data’’ 23 means covered data that is created by the derivation 24 of information, data, assumptions, or conclusions 25 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 8 •S 2968 IS from facts, evidence, or another source of informa- 1 tion or data about an individual, household, or de- 2 vice used by an individual or household. 3 (12) EMPLOYEE DATA.—The term ‘‘employee 4 data’’ means— 5 (A) covered data that is collected by a cov- 6 ered entity or the covered entity’s service pro- 7 vider about an individual in the course of the 8 individual’s employment or application for em- 9 ployment (including on a contract or temporary 10 basis) provided that such data is retained or 11 processed by the covered entity or the covered 12 entity’s service provider solely for purposes nec- 13 essary for the individual’s employment or appli- 14 cation for employment; 15 (B) covered data that is collected by a cov- 16 ered entity or the covered entity’s service pro- 17 vider that is emergency contact information for 18 an individual who is an employee, contractor, or 19 job applicant of the covered entity provided that 20 such data is retained or processed by the cov- 21 ered entity or the covered entity’s service pro- 22 vider solely for the purpose of having an emer- 23 gency contact for such individual on file; and 24 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 9 •S 2968 IS (C) covered data that is collected by a cov- 1 ered entity or the covered entity’s service pro- 2 vider about an individual (or a relative of an in- 3 dividual) who is an employee or former em- 4 ployee of the covered entity for the purpose of 5 administering benefits to which such individual 6 or relative is entitled on the basis of the individ- 7 ual’s employment with the covered entity, pro- 8 vided that such data is retained or processed by 9 the covered entity or the covered entity’s service 10 provider solely for the purpose of administering 11 such benefits. 12 (13) EXECUTIVE AGENCY.—The term ‘‘Execu- 13 tive agency’’ has the meaning given such term in 14 section 105 of title 5, United States Code. 15 (14) INDIVIDUAL.—The term ‘‘individual’’ 16 means a natural person residing in the United 17 States, however identified, including by any unique 18 identifier. 19 (15) LARGE DATA HOLDER.—The term ‘‘large 20 data holder’’ means a covered entity that, in the 21 most recent calendar year— 22 (A) processed or transferred the covered 23 data of more than 5,000,000 individuals, de- 24 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 10 •S 2968 IS vices used by individuals or households, or 1 households; or 2 (B) processed or transferred the sensitive 3 covered data of more than 100,000 individuals, 4 devices used by individuals or households, or 5 households. 6 (16) PROCESS.—The term ‘‘process’’ means 7 any operation or set of operations performed on cov- 8 ered data including collection, analysis, organization, 9 structuring, retaining, using, or otherwise handling 10 covered data. 11 (17) PROCESSING PURPOSE.—The term ‘‘proc- 12 essing purpose’’ means an adequately specific and 13 granular reason for which a covered entity processes 14 covered data that clearly describes the processing ac- 15 tivity. 16 (18) PUBLICLY AVAILABLE INFORMATION.— 17 (A) IN GENERAL.—The term ‘‘publicly 18 available information’’ means— 19 (i) information that a covered entity 20 has a reasonable basis to believe is lawfully 21 made available to the general public from 22 widely distributed media; and 23 (ii) information that is directly and 24 voluntarily disclosed to the general public 25 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 11 •S 2968 IS by the individual to whom the information 1 relates. 2 (B) LIMITATION.—Such term does not in- 3 clude— 4 (i) information derived from publicly 5 available information; 6 (ii) biometric information; or 7 (iii) nonpublicly available information 8 that has been combined with publicly avail- 9 able information. 10 (19) PUBLIC RECORDS.—The term ‘‘public 11 records’’ means information that is lawfully made 12 available from Federal, State, or local government 13 records provided that the covered entity processes 14 and transfers such information in accordance with 15 any restrictions or terms of use placed on the infor- 16 mation by the relevant government entity. 17 (20) SENSITIVE COVERED DATA.—The term 18 ‘‘sensitive covered data’’ means the following forms 19 of covered data: 20 (A) A government-issued identifier, such as 21 a Social Security number, passport number, or 22 driver’s license number. 23 (B) Any information that describes or re- 24 veals the past, present, or future physical 25 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 12 •S 2968 IS health, mental health, disability, or diagnosis of 1 an individual. 2 (C) A financial account number, debit card 3 number, credit card number, or any required 4 security or access code, password, or credentials 5 allowing access to any such account. 6 (D) Biometric information. 7 (E) Precise geolocation information that 8 reveals the past or present actual physical loca- 9 tion of an individual or device. 10 (F) The content or metadata of an individ- 11 ual’s private communications or the identity of 12 the parties to such communications unless the 13 covered entity is an intended recipient of the 14 communication. 15 (G) An email address, telephone number, 16 or account log-in credentials. 17 (H) Information revealing an individual’s 18 race, ethnicity, national origin, religion, or 19 union membership in a manner inconsistent 20 with the individual’s reasonable expectation re- 21 garding disclosure of such information. 22 (I) Information revealing the sexual ori- 23 entation or sexual behavior of an individual in 24 a manner inconsistent with the individual’s rea- 25 VerDate Sep 11 2014 04:06 Dec 06, 2019 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S2968.IS S2968 kjohnson on DSK79L0C42 with BILLS 13 •S 2968 IS sonable expectation re [Text truncated for display. Full text available on Congress.gov.]